Nicholas Zubrisky

Vulnerability Researcher @ TrendAI Zero Day Initiative

[Michael DePlante @izobashi]

Exciting news! I'm hiring experienced vulnerability researchers @theZDI.

Do you love VR, sharing your work, and want to run categories at Pwn2Own? Come work with us (remotely).

Apply here: https://t.co/n7asBQcNOC

Feel free to DM me if you have any questions.

[TheZDIBugs @TheZDIBugs]

[ZDI-26-364|CVE-2026-41264] FlowiseAI Flowise CSV Agent Prompt Injection Remote Code Execution Vulnerability (CVSS 9.8; Credit: Dre Cura (@dre_cura) and Nicholas Zubrisky (@NZubrisky) of TrendAI Research) https://t.co/MtmYDG98FI

[TheZDIBugs @TheZDIBugs]

[ZDI-26-365|CVE-2026-41137] FlowiseAI Flowise CSV Agent customReadCSV Code Injection Remote Code Execution Vulnerability (CVSS 8.8; Credit: Nicholas Zubrisky (@NZubrisky) of TrendAI Research) https://t.co/Jr5ezuwQm4

[TheZDIBugs @TheZDIBugs]

[ZDI-26-307|CVE-2026-41265] FlowiseAI Flowise Airtable_Agent Code Injection Remote Code Execution Vulnerability (CVSS 9.8; Credit: Dre Cura (@dre_cura) and Nicholas Zubrisky (@NZubrisky) of TrendAI Research) https://t.co/NgQXzhdFc8

[TheZDIBugs @TheZDIBugs]

[ZDI-26-300|CVE-2026-41276] Flowise AccountService resetPassword Authentication Bypass Vulnerability (CVSS 8.1; Credit: Nicholas Zubrisky (@NZubrisky) of TrendAI Research) https://t.co/pZ2yo07iam

[Bad_Jubies @Bad_Jubies]

I made a write up diffing and triggering a use after free vulnerability in AFD.sys that was fixed in this month’s patch Tuesday:

https://t.co/Tq7aoSsP6D

[TheZDIBugs @TheZDIBugs]

[ZDI-25-981|CVE-2025-12488] oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability (CVSS 9.8; Credit: Nicholas Zubrisky (@NZubrisky) of Trend Micro Security Research) https://t.co/qypOCmIsNM

[TheZDIBugs @TheZDIBugs]

[ZDI-25-982|CVE-2025-12487] oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability (CVSS 9.8; Credit: Nicholas Zubrisky (@NZubrisky) of Trend Micro Security Research) https://t.co/nhjzBorsXS

[TheZDIBugs @TheZDIBugs]

[ZDI-25-916|CVE-2025-38561] Linux Kernel ksmbd smb2_sess_setup Preauth_HashValue Race Condition Remote Code Execution Vulnerability (CVSS 8.5; Credit: Nicholas Zubrisky (@NZubrisky) of Trend Research) https://t.co/0ZTiyLe7ov

[Crusaders of Rust @cor_ctf]

Say hello to Eternal Tux🐧, a 0-click RCE exploit against the Linux kernel from KSMBD N-Days (CVE-2023-52440 & CVE-2023-4130)

https://t.co/Cbk9MBo91v

Cheers to @u1f383 for finding these CVEs + the OffensiveCon talk from gteissier & @laomaiweng for inspiration!

[xvonfers @xvonfers]

(ZDI-CAN-27661)[ksmbd]Send multiple session setup requests to ksmbd -> Preauh_HashValue race condition
https://t.co/MBf6r6Ru3q

Reported by Nicholas Zubrisky (@NZubrisky)

[Filip Dragovic @filip_dragovic]

Today MSRC fixed two vulnerabilities I reported a couple months ago.
EoP in Windows Update service (affects only windows 11/10 with at least 2 drives)
https://t.co/YnCsk1934F
EoP in Microsoft PC Manager
https://t.co/ssudyvpgDS
PoC for CVE-2025-48799:
https://t.co/brRVf18DnY

[xvonfers @xvonfers]

🤔
https://t.co/W5HazElvGV

@NZubrisky

[Neodyme @Neodyme]

From iframes and file reads to full RCE. 🔥

We found an HTML-to-PDF API allowing file reads and SSRF - then chained it into remote code execution via a Chromium 62 WebView exploit.

👉 Read the full write-up here: https://t.co/Qa5Beuuncr

[flomb - @fl0mb.bsky.social @flomb_]

https://t.co/9ZqLF7fGxI

[starlabs @starlabs_sg]

CimFS: Crashing in memory, Finding SYSTEM! @cplearns2h4ck dug into Microsoft CimFS, found a sneaky 0-day, and guess what? The fix by Microsoft was just locking the door 🔐on unprivileged users. 😂
Dive into the adventure with us: https://t.co/7g30HpmFzG

[TheZDIBugs @TheZDIBugs]

[ZDI-25-151|CVE-2025-1758] Progress Software Kemp LoadMaster mangle Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 9.8; Credit: Nicholas Zubrisky (@NZubrisky) of Trend Micro Security Research) https://t.co/FaIyDuHMFB

[Maxim Suhanov @errno_fail]

(A new class of symlink attacks is mentioned below.)

According to Microsoft (MSRC), attacks involving symlinks stored on removable drives or in file system images (like VHDX) are not vulnerabilities.

If an unprivileged user manages to quickly replace a regular file... 1/7

[Neodyme @Neodyme]

Following our #38c3 talk about exploiting security software for privilege escalation, we're excited to kick off a new blog series! 🎊
Check out our first blog post on our journey to 💥 exploit five reputable security products to gain privileges via COM hijacking: https://t.co/5ne5FBggZl

[TrendAI Zero Day Initiative @thezdi]

ZDI Threat Hunting 2024: Highlights, Trends, & Challenges - @gothburz takes a look at the key achievements of our Threat Hunting team. He also looks at in-the-wild vuln trends and industry challenges we encountered in 2024 that will continue into 2025. https://t.co/4Tcvpne2Di